From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:33739) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T2Lnr-0006su-Ro for qemu-devel@nongnu.org; Fri, 17 Aug 2012 08:37:29 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1T2Lnp-0001Wc-QC for qemu-devel@nongnu.org; Fri, 17 Aug 2012 08:37:27 -0400 Received: from mail-out.m-online.net ([212.18.0.9]:55733) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T2Lnp-0001W3-Je for qemu-devel@nongnu.org; Fri, 17 Aug 2012 08:37:25 -0400 From: Marek Vasut Date: Fri, 17 Aug 2012 14:37:20 +0200 References: <1345172107-27092-1-git-send-email-marex@denx.de> <502E3699.701@msgid.tls.msk.ru> In-Reply-To: <502E3699.701@msgid.tls.msk.ru> MIME-Version: 1.0 Content-Type: Text/Plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Message-Id: <201208171437.21061.marex@denx.de> Subject: Re: [Qemu-devel] [PATCH] vmware_vga: Redraw only visible area List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Michael Tokarev Cc: qemu-devel@nongnu.org Dear Michael Tokarev, > On 17.08.2012 06:55, Marek Vasut wrote: > > Disallow negative value boundaries of the redraw rectangle. > > This fixes a segfault when using -vga vmware. > > > > Signed-off-by: Marek Vasut > > --- > > > > hw/vmware_vga.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > NOTE: I tested this by emulating some recent version of ubuntu. The > > rect->x > > > > value was set to -65 for some reason at one point, which caused the > > kvm to crash. Trimming the rectangle fixed the issue. > > > > diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c > > index f5e4f44..62e5887 100644 > > --- a/hw/vmware_vga.c > > +++ b/hw/vmware_vga.c > > @@ -337,8 +337,8 @@ static inline void vmsvga_update_rect_delayed(struct > > vmsvga_state_s *s, > > > > { > > > > struct vmsvga_rect_s *rect = &s->redraw_fifo[s->redraw_fifo_last > > ++]; s->redraw_fifo_last &= REDRAW_FIFO_LEN - 1; > > > > - rect->x = x; > > - rect->y = y; > > + rect->x = (x < 0) ? 0 : x; > > + rect->y = (y < 0) ? 0 : y; > > > > rect->w = w; > > rect->h = h; > > > > } > > Is it the same as https://bugs.launchpad.net/bugs/918791 ? > At least it appears to be the same theme... But there, > the patch (https://launchpadlibrarian.net/94916786/qemu-vmware.debdiff) > also updates width/height. My comment: > https://bugs.launchpad.net/ubuntu/+source/qemu-kvm/+bug/918791/comments/21 Looks to be the same ... though my patch tries to squash the issue as early as possible. You're right that x and y might overflow to the other side too. Also, you're right about w and h. Shall I send updated patch? > "So indeed, some (upstream) verification is needed here -- where these > negative values are coming from, whenever it is EVER okay to have them, > what to do with these, and where to check (I guess the check should be > done somewhere in the upper layer)." > > Especially the last part about the layer. Where's the upper layer though, isn't that what's pouring out of the virtual machine itself? > Thanks, Thank you for guidance ! > /mjt Best regards, Marek Vasut